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From: 

Sent: 05 February 2020 12:16 

To: SARguidance 

Subject: ICO consultation on the draft right of access guidance 


External: This email originated outside the ICO. 
Hello, 


| would like to provide the following feedback on the draft guidance. 


The draft guidance provides helpful examples to assist with responding to data subject access requests, for example 
the section ‘can we clarify a request?’ (page 23) and that the right is to personal data rather than documents and so 
just sections of documents can be provided (page 30). It would be helpful to have additional detail/guidance on the 
following areas linked to our experience of responding to subject access requests: 


Where a staff member leaves and their email account has been closed (and will not be accessed or reopened by the 
organisation), can this information be considered ‘put beyond use’ and therefore outside of a data subject access 
request? 


Separation of what is personal information and what is business information. For example, where the data subject 
is a manager, and therefore receives multiple emails/communications which are transactional and about other 
people rather than the data subject, can we classify this as business information rather than personal information 
(and so is outside of a data subject access request). Or is this something which we should clarify with the data 
subject? If information has been provided in a payslip form (as personal information), is it also necessary to provide 
the same information which is contained in payroll/timesheet reports (business information)? 
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